Skip to main content

Authentication

Every request carries an API key in the Authorization header.

curl https://api.because.eco/api/v1/unit-types \
  -H "Authorization: YOUR_API_KEY"

Getting a key​

Keys are created and revoked by you, in the BeCause app, at API key management. Create one key per integration rather than sharing a single key between systems — revoking a key affects every caller using it.

Treat a key as a credential: keep it server-side, out of source control, and out of anything a browser can read.

A key acts as the profile that created it​

This is the part most worth understanding before you build.

A key is bound to the BeCause profile that was signed in when the key was created. Requests made with that key act as that profile, and every access check follows from it — which companies you may read, and which you may write data against.

If you manage several profiles, the key you use decides which one you are operating as. Using the wrong key does not usually produce an authentication error; it produces a successful request that touched the wrong set of companies, or that silently matched nothing. If a bulk request completes with fewer results than you expected, check the key before you check the payload.

Failures​

A missing, malformed or revoked key is rejected before any processing happens. A key that is valid but whose profile has no access to a company you referenced does not fail the request — the request succeeds and that company is simply not acted on. Bulk results report per-item outcomes for exactly this reason; read them rather than relying on the request's overall status.